CVE-2023-25804

Summary

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a limited path traversal vulnerability. An SSH key can be saved into an unintended location, for example the /tmp folder using a payload ../../../../../tmp/test111_dev. This issue has been fixed in version 6.3.5.0.

Affected Software

Weaknesses

• CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-69j6-crq8-rrhv

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-69j6-crq8-rrhv

• ←Previous
• Next→